﻿using System;
using System.Collections.Generic;

namespace Confessor
{
    static class BuildConfessorScript
    {
        static public void CreateConfessorScript(System.Windows.Forms.TreeView treeview, ScanObject scanObject, string toolPath, string resultsPath, bool local)
        {
            // Set up the FileAction's class so we can utilize it's methods.
            xFileActions xFA = new xFileActions();

            // List to hold the items which will be written into our script.
            List<string> confessorScript = new List<string>();

            // If not using shares... meaning things are copied locally, the tools need to be extracted, and then at the end zipped up.......
            if (local)
            {
                confessorScript.Add(@"c:\CONFESSOR\7za.exe x -y -oc:\CONFESSOR c:\CONFESSOR\tools.zip");
            }

            #region Default Confessor CMD's
            //The following are entered into every Confess.bat batch file.
            confessorScript.Add(@"ECHO Investigation ID: " + scanObject.InvestigationID);
            confessorScript.Add(@"ECHO Tool Share > " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO " + toolPath + " >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO Results Share >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO "+ resultsPath + @" >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO Whoami results >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"whoami >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO Time information from the Network and target computer %COMPUTERNAME%. >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"net time >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(toolPath + @"\now.exe >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"Echo Operating System Version >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ver.exe >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> " + resultsPath + @"CONFESSOR.log");
            #endregion

            //Prepare to write additional items to run based of of treeview checkbox decisions.
            #region Network Stack
            //Network Stack
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[0].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running IPconfig /all on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"ipconfig /all > " + resultsPath + @"ipconfig.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[1].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running arp -a on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"arp -a > " + resultsPath + @"arp.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[2].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running netstat -abno on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"netstat -abno > " + resultsPath + @"netstat.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[3].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running nbtstat -c on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"nbtstat -c >> " + resultsPath + @"nbtstat.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[4].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running nbtstat -S on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"nbtstat -S >> " + resultsPath + @"nbtstat.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[5].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\TCPView /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running tcpvcon -a on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\tcpvcon.exe -a > " + resultsPath + @"tcpvcon.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[6].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running openports on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\openports.exe > " + resultsPath + @"openports.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region Volatile Information
            // Volatile Information
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[0].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsInfo /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running PSInfo.exe -d -s on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\psinfo.exe -d -s > " + resultsPath + @"PSInfo.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[1].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running srvinfo.exe -s on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\srvinfo.exe -s > " + resultsPath + @"server.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[2].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running srvinfo.exe -d on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\srvinfo.exe -d > " + resultsPath + @"server.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[3].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running Systeminfo on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"Systeminfo.exe > " + resultsPath + @"systeminfo.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[4].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net use on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net use > " + resultsPath + @"net_use.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[5].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net view on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net view %COMPUTERNAME% > " + resultsPath + @"net_view.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[6].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net share on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net share > " + resultsPath + @"net_share.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[7].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net session on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net session > " + resultsPath + @"net_session.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[8].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net file on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net file > " + resultsPath + @"net_file.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[9].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsList /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running PSList.exe -mx/-t on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\PSList.exe -mx > " + resultsPath + @"pstasklist.log 2>> " + resultsPath + @"error.log");
                confessorScript.Add(toolPath + @"\PSList.exe -t >> " + resultsPath + @"pstasklist.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[10].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running tasklist /svc /fo csv on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"tasklist /svc /fo csv > " + resultsPath + @"tasklist.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[11].Checked)
            {
                confessorScript.Add(@"now.exe [Running tlist.exe -t/-c/-s on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"tlist.exe -t > " + resultsPath + @"tlist.log 2>> " + resultsPath + @"error.log");
                confessorScript.Add(@"tlist.exe -c >> " + resultsPath + @"tlist.log 2>> " + resultsPath + @"error.log");
                confessorScript.Add(@"tlist.exe -s >> " + resultsPath + @"tlist.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[12].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\ListDLLs /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running listdlls.exe on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\listdlls.exe > " + resultsPath + @"listdlls.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[13].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\Handle /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running handle.exe -au on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\handle.exe -au > " + resultsPath + @"handles.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[14].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running openfiles /query on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\openfiles.exe /query /fo csv > " + resultsPath + @"openfiles.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[15].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsService /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running PSservice.exe on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\PSservice.exe > " + resultsPath + @"services.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[16].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running driverquery on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\driverquery.exe /fo csv /si > " + resultsPath + @"driverquery.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[17].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running sc.exe /query on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"sc.exe query > " + resultsPath + @"SC_Query.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[18].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\psfile /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running PSFile.exe on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\PSFile.exe > " + resultsPath + @"PSfiles.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[19].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running at.exe on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"at.exe > " + resultsPath + @"at.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[20].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running set on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"set > " + resultsPath + @"set.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[21].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running ftype on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"ftype > " + resultsPath + @"ftype.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[22].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running assoc on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"assoc > " + resultsPath + @"assoc.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[23].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running showacls on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\showacls.exe > " + resultsPath + @"showacls.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region Account and User Information
            //Account and User Information
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[0].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\LogonSessions /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running logonsessions.exe -p on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\LogonSessions.exe -p > " + resultsPath + @"logonsessions.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[1].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\psloggedon /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running psloggedon.exe on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\psloggedon.exe > " + resultsPath + @"Psloggedon.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[2].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net localgroup administrators on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net localgroup administrators > " + resultsPath + @"admin_accounts.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[3].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running net user on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"net user > " + resultsPath + @"net_user.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[4].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running showpriv (for Win2k3) on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\showpriv.exe SeLockMemoryPrivilege > " + resultsPath + @"showpriv.log 2>> " + resultsPath + @"error.log");
                confessorScript.Add(toolPath + @"\showpriv.exe SeSecurityPrivilege >> " + resultsPath + @"showpriv.log 2>> " + resultsPath + @"error.log");
                confessorScript.Add(toolPath + @"\showpriv.exe SeTakeOwnershipPrivilege >> " + resultsPath + @"showpriv.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region Compromised Code
            //Compromised Code
            if (treeview.Nodes[3].Checked || treeview.Nodes[3].Nodes[0].Checked)
            {
                confessorScript.Add(@"REM   REG ADD HKCU\Software\Sysinternals\SigCheck /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"REM	now.exe [Running sigcheck.exe on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"REM	sigcheck.exe -e -i -s -u C:\ > " + resultsPath + @"sigcheck.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[3].Checked || treeview.Nodes[3].Nodes[1].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe -a -v on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe -a -v > " + resultsPath + @"autorunsc.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[3].Checked || treeview.Nodes[3].Nodes[2].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running doskey /history on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"doskey /history > " + resultsPath + @"doskey.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region Event Logs
            //Event Logs
            if (treeview.Nodes[4].Checked || treeview.Nodes[4].Nodes[0].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsLoglist /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running psloglist for Security events on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\psloglist.exe -s -t \t security > " + resultsPath + @"psloglistSECURITY.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[4].Checked || treeview.Nodes[4].Nodes[1].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running psloglist for Security events on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\psloglist.exe -s -t \t application > " + resultsPath + @"psloglistAPPLICATION.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[4].Checked || treeview.Nodes[4].Nodes[2].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running psloglist for System events on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\psloglist.exe -s -t \t system > " + resultsPath + @"psloglistSYSTEM.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region MAC Times
            // Modified Accessed and Changed Times
            if (treeview.Nodes[5].Checked || treeview.Nodes[5].Nodes[0].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running file MODIFY time check on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"dir /t:w /o:d /a /s C:\ > " + resultsPath + @"MODIFYtime_Mac.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[5].Checked || treeview.Nodes[5].Nodes[1].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running file ACCESS time check on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"dir /t:a /o:d /a /s C:\ > " + resultsPath + @"ACCESStime_mAc.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[5].Checked || treeview.Nodes[5].Nodes[2].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running file CREATE time check on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(@"dir /t:c /o:d /a /s C:\ > " + resultsPath + @"CREATEtime_maC.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region SecCheck
            // SecCheck.exe (Not good for 2k8 hosts
            if (treeview.Nodes[6].Checked)
            {
                confessorScript.Add(toolPath + @"\now.exe [Running seccheck on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\seccheck.exe > " + resultsPath + @"seccheck.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #region ASEP (AutoStart Entry Points)
            // The following are where programs could auto start in Windows. (registry keys and the like)

            #region Autorunsc
            //Autorunsc
            string autorunsOptions = @"-";
            if(treeview.Nodes[7].Nodes[0].Nodes[0].Checked)
            {
                // Hide signed Microsoft Entries
                autorunsOptions += "m";
            }
            if (treeview.Nodes[7].Nodes[0].Nodes[1].Checked)
            {
                // Verify Digital Signatures
                autorunsOptions += "v";
            }
            if (treeview.Nodes[7].Nodes[0].Nodes[2].Checked)
            {
                // CSV output
                autorunsOptions += "c";
            }
            if (treeview.Nodes[7].Nodes[0].Nodes[3].Checked && !treeview.Nodes[7].Nodes[0].Nodes[2].Checked)
            {
                // XML output
                autorunsOptions += "x";
            }


            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[0].Checked)
            {
                //Boot Execute
                string autorunsOptionsX = (autorunsOptions + "b");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Boot_Execute.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[1].Checked)
            {
                //Appinit DLLs                
                string autorunsOptionsX = (autorunsOptions + "d");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Appinit_DLLs.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[2].Checked)
            {
                //Explorer Addons
                string autorunsOptionsX = (autorunsOptions + "e");                
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Explorer_Addons.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[3].Checked)
            {
                //Sidebar Gadgets
                string autorunsOptionsX = (autorunsOptions + "g");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Sidebar_Gadgets.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[4].Checked)
            {
                //Image Hijacks
                string autorunsOptionsX = (autorunsOptions + "h");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Image_Hijacks.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[5].Checked)
            {
                //Internet Explorer Addons
                string autorunsOptionsX = (autorunsOptions + "i");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_IE_Addons.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[6].Checked)
            {
                //Logon Startups
                string autorunsOptionsX = (autorunsOptions + "l");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Logon_Startups.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[7].Checked)
            {
                //Winsock protocol and Network Providers
                string autorunsOptionsX = (autorunsOptions + "n");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Winsock_Protocol_Network_Providers.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[8].Checked)
            {
                //Print Monitor Drivers
                string autorunsOptionsX = (autorunsOptions + "p");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Print_Monitor.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[9].Checked)
            {
                //LSA Providers
                string autorunsOptionsX = (autorunsOptions + "r");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_LSA_Providers.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[10].Checked)
            {
                //Autostart Services and non-disabled Drivers
                string autorunsOptionsX = (autorunsOptions + "s");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_AutostartServices_Drivers.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[11].Checked)
            {
                //Scheduled Tasks
                string autorunsOptionsX = (autorunsOptions + "t");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Scheduled_Tasks.log 2>> " + resultsPath + @"error.log");
            }
            if (treeview.Nodes[7].Checked || treeview.Nodes[7].Nodes[0].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Checked || treeview.Nodes[7].Nodes[0].Nodes[4].Nodes[12].Checked)
            {
                //Winlogon Entries
                string autorunsOptionsX = (autorunsOptions + "w");
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(toolPath + @"\now.exe [Running autorunsc.exe " + autorunsOptionsX + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                confessorScript.Add(toolPath + @"\autorunsc.exe " + autorunsOptionsX + @" > " + resultsPath + @"autorunsc_Winlogon_Entries.log 2>> " + resultsPath + @"error.log");
            }
            #endregion

            #endregion

            #region Used for Testing | Will write the file locally to help determine any issues.
            //The following are entered into every Confess.bat batch file.
            if (treeview.Nodes[8].Checked)
            {
                confessorScript.Add(@"ECHO TEST LOCALLY NOW, PREVIOUS ENTRIES TRIED TO WRITE REMOTELY");
                confessorScript.Add(@"ECHO Tool Share > c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO " + toolPath + @" >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO " + toolPath + @" >> " + resultsPath + @"CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO " + toolPath + @" >> " + resultsPath + @"CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO Results Share >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO " + resultsPath + @" >> c:\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO. >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO Whoami results >> C:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"whoami >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO. >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO Time information from the Network and target computer %COMPUTERNAME%. >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"net time >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO. >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(toolPath + @"\now.exe >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO. >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"Echo Operating System Version >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ver.exe >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
                confessorScript.Add(@"ECHO. >> c:\CONFESSOR\CONFESSOR.log 2 >> c:\CONFESSOR\ConfessorError.log");
            }
            #endregion

            #region User Defined Runtimes / RegKey / Process Starts
            // User Defined Data

            //RegKey Data
            if (scanObject.customRegKey1.Length > 0)
            {
                if (scanObject.RegKeyValues)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Grabbing Reg Values for: " + scanObject.customRegKey1 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"reg query " + "\"" + scanObject.customRegKey1 + "\"" + @" > " + resultsPath + @"regKey1.values.log 2>> " + resultsPath + @"regKey1.error.log");
                }
                if (scanObject.RegKeyCopy)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Exporting RegKey: " + scanObject.customRegKey1 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"reg export " + "\"" + scanObject.customRegKey1 + "\"" + @" > " + resultsPath + @"regKey1.reg /y 2>> " + resultsPath + @"regKey1.error.log");
                }
            }
            if (scanObject.customRegKey2.Length > 0)
            {
                if (scanObject.RegKeyValues)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Grabbing Reg Values for: " + scanObject.customRegKey2 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"reg query " + "\"" + scanObject.customRegKey2 + "\"" + @" > " + resultsPath + @"regKey2.values.log 2>> " + resultsPath + @"regKey2.error.log");
                }
                if (scanObject.RegKeyCopy)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Exporting RegKey: " + scanObject.customRegKey2 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"reg export " + "\"" + scanObject.customRegKey2 + "\"" + @" > " + resultsPath + @"regKey2.reg /y 2>> " + resultsPath + @"regKey2.error.log");
                }
            }
            if (scanObject.customRegKey3.Length > 0)
            {
                if (scanObject.RegKeyValues)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Grabbing Reg Values for: " + scanObject.customRegKey3 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"reg query " + "\"" + scanObject.customRegKey3 + "\"" + @" > " + resultsPath + @"regKey3.values.log 2>> " + resultsPath + @"regKey3.error.log");
                }
                if (scanObject.RegKeyCopy)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Exporting RegKey: " + scanObject.customRegKey3 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"reg export " + "\"" + scanObject.customRegKey3 + "\"" + @" > " + resultsPath + @"regKey3.reg /y 2>> " + resultsPath + @"regKey3.error.log");
                }
            }

            //File Data
            if (scanObject.customFile1.Length > 0)
            {
                string[] filepathArray = scanObject.customFile1.Split('\\');
                int x = (filepathArray.Length - 1);
                string fileName = filepathArray[x];

                if (scanObject.FileExists)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Checking for existence of file: " +scanObject.customFile1 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /b " + "\"" + scanObject.customFile1 + "\"" + @" > " + resultsPath + @"file1.exists.log 2>> " + resultsPath + @"file1.exists.notfound.log");
                }
                if (scanObject.FileCopy)
                {
                    confessorScript.Add(toolPath + @"\now.exe [If file exists, copying file over to evidence folder: " + scanObject.customFile1 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"copy /Y " + "\"" + scanObject.customFile1 + "\" " + resultsPath + fileName + @" 2>> " + resultsPath + @"file1.copy.notfound.log");
                }
                if (scanObject.FileExistsSystem)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Checking for existence of file on C: " + scanObject.customFile1 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /b /s " + "\"" + scanObject.customFile1 + "\"" + @" > " + resultsPath + @"file1.existsOnSystem.log 2>> " + resultsPath + @"file1.existsOnSystem.notfound.log");
                }
                if (scanObject.FileOwner)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Gathering file ownership for: " + scanObject.customFile1 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /q " + "\"" + scanObject.customFile1 + "\"" + @" > " + resultsPath + @"file1.ownership.log 2>> " + resultsPath + @"file1.ownership.notfound.log");
                }

            }
            if (scanObject.customFile2.Length > 0)
            {
                string[] filepathArray = scanObject.customFile2.Split('\\');
                int x = (filepathArray.Length - 1);
                string fileName = filepathArray[x];

                if (scanObject.FileExists)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Checking for existence of file: " + scanObject.customFile2 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /b " + "\"" + scanObject.customFile2 + "\"" + @" > " + resultsPath + @"file2.exists.log 2>> " + resultsPath + @"file2.exists.notfound.log");
                }
                if (scanObject.FileCopy)
                {
                    confessorScript.Add(toolPath + @"\now.exe [If file exists, copying file over to evidence folder: " + scanObject.customFile2 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"copy /Y " + "\"" + scanObject.customFile2 + "\" " + resultsPath + fileName + @" 2>> " + resultsPath + @"file2.copy.notfound.log");
                }
                if (scanObject.FileExistsSystem)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Checking for existence of file on C: " + scanObject.customFile2 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /b /s " + "\"" + scanObject.customFile2 + "\"" + @" > " + resultsPath + @"file2.existsOnSystem.log 2>> " + resultsPath + @"file2.existsOnSystem.notfound.log");
                }
                if (scanObject.FileOwner)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Gathering file ownership for: " + scanObject.customFile2 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /q " + "\"" + scanObject.customFile2 + "\"" + @" > " + resultsPath + @"file2.ownership.log 2>> " + resultsPath + @"file2.ownership.notfound.log");
                }

            }
            if (scanObject.customFile3.Length > 0)
            {
                string[] filepathArray = scanObject.customFile3.Split('\\');
                int x = (filepathArray.Length - 1);
                string fileName = filepathArray[x];

                if (scanObject.FileExists)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Checking for existence of file: " + scanObject.customFile3 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /b " + "\"" + scanObject.customFile3 + "\"" + @" > " + resultsPath + @"file3.exists.log 2>> " + resultsPath + @"file3.exists.notfound.log");
                }
                if (scanObject.FileCopy)
                {
                    confessorScript.Add(toolPath + @"\now.exe [If file exists, copying file over to evidence folder: " + scanObject.customFile3 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"copy /Y " + "\"" + scanObject.customFile3 + "\" " + resultsPath + fileName + @" 2>> " + resultsPath + @"file3.copy.notfound.log");
                }
                if (scanObject.FileExistsSystem)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Checking for existence of file on C: " + scanObject.customFile3 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /b /s " + "\"" + scanObject.customFile3 + "\"" + @" > " + resultsPath + @"file3.existsOnSystem.log 2>> " + resultsPath + @"file3.existsOnSystem.notfound.log");
                }
                if (scanObject.FileOwner)
                {
                    confessorScript.Add(toolPath + @"\now.exe [Gathering file ownership for: " + scanObject.customFile3 + @" on %COMPUTERNAME%.] >> " + resultsPath + @"CONFESSOR.log");
                    confessorScript.Add(@"dir /a /q " + "\"" + scanObject.customFile3 + "\"" + @" > " + resultsPath + @"file3.ownership.log 2>> " + resultsPath + @"file3.ownership.notfound.log");
                }

            }
            #endregion

            #region Confessor End Script ~FIN
            // And here we zip up our results before saying bye bye and deleting the tools.
            if (local)
            {
                confessorScript.Add(@"c:\CONFESSOR\7za.exe a c:\CONFESSOR\Results\results.zip c:\confessor\results\*");
            }
            confessorScript.Add(toolPath + @"\now.exe [Confessor script finished.] >> " + resultsPath + @"CONFESSOR.log");
            confessorScript.Add(@"Echo Finished >> " + resultsPath + @"_finished.txt");
            #endregion

            // Write the script through the FileAction Class
            xFA.WriteConfessorScript(confessorScript, scanObject);
        }
    }
}
